If your business makes sales online, watch out for a different kind of scam targeting companies: synthetic identity fraud.
Advertisement
Teacher Photo via Shutterstock.com
Synthetic identity fraud, a growing strain of online fraud targets not individuals, but businesses both large and small.
Advertisement
Advertisement
For the victims of digital fraud, it’s personal. It can feel like they were specifically preyed upon. But the fact is cyber criminals don’t care whether their ill-gotten gains come from individuals, small businesses or banks, or who is left violated. What they care about is that the scam works—and that they don’t get caught.
If you own or operate a business, you should know about synthetic identity fraud, take precautions, and report suspicious activity.
What is synthetic identity fraud?
Synthetic identity theft is a form of financial fraud in which a real person’s key information, such as their name, social insurance number (SIN), and date of birth, is obtained through a data breach, online/phone scam, or by buying it off the dark web. It’s then combined with other falsified personal information to create a new hybrid identity.
Criminals use these “Frankenstein” identities to take out loans or set up bank and credit-card accounts. At some point they will typically stage a “bust out” fraud, charging or borrowing a large sum of money and then disappearing without a trace. Or, they might try to use the accounts they open to store money obtained illegally or even use the synthetic identity to hide from authorities.
This kind of scam is growing more and more common. In Canada, synthetic identity fraud doubled as a proportion of all fraudulent credit applications between 2022 and 2024.
How the scam unfolds
To the online seller, they may just look like the perfect customer. They gradually increase the frequency of their patronage and pay their bills on time. Unfortunately, they don’t exist!
Synthetic identity fraud is usually a long con, following a series of steps over months or years:
The opening: The fraudster obtains some information on a real person. They then combine that real information with made-up info to create a synthetic identity and use that identity to apply for an entry-level credit product, such as a secured or low-limit credit card.
The build up: The “client” racks up charges and pays off the balance every month.
The upgrade: The good credit behaviour causes traditional risk models to recognize the identity as a reliable borrower. The bank or business typically increases credit limits or upgrades the account to an unsecured card.
The credit climb: After 12 to 24 months, the identity’s credit score reaches prime territory, allowing the scammer to take out personal or car loans in its name.
The bust out: The fraudster maxes out their credit all at once, making off with cash or financed merchandise, and disappears without a trace.
How businesses can spot phantom customers
Unlike identity theft targeting individuals, there is no direct victim of synthetic identity fraud, meaning it may not be detected or reported, let alone prosecuted, for a long time. Synthetic fraudsters often target people with limited or inactive credit histories such as children, seniors, and even deceased people to create new identities. Such victims are less likely to check their credit reports, allowing the fraud the required time to unfold.
Article Continues Below Advertisement
When a business gets defrauded, they might wrongly categorize it as bad debt from a delinquent customer. The only indication a business might have that a customer may not exist is that their online behaviour may be a little too perfect. Their credit history may appear flawless and their record of credit acquisition may look methodical. This is because the scammers want to build up a good credit score in the shortest time possible.
Real people, by contrast, tend to apply for credit as life’s priorities present themselves. Discerning the difference between real and fake customers has driven financial institutions and credit agencies to look for “digital dust,” non-traditional data like ecommerce, digital identity, and behavioural data that shows a person is indeed real.
Equifax Canada has developed a tool for businesses, Synthetic Identity Score, that uses machine learning to determine the likelihood that the subject of a credit file is fake. This allows businesses to fast-track high-confidence credit applications while directing higher-risk cases toward secondary review processes. Companies can also apply the Synthetic Identity Score analysis to their existing databases to potentially uncover ongoing synthetic identity fraud cases. In one study, 30% of the riskiest 10% of new customer identities went on to become delinquent.
FAQs
Businesses, banks and individuals can all be harmed by synthetic identity fraud. Credit issuers are most commonly left out of pocket by a successful bust out, but small businesses offering their own credit can be victimized too. U.S. data indicates synthetic identity fraud now accounts for one-fifth of all credit losses, which gets baked into the cost of doing business. Consumers whose information has been used to create a synthetic identity can potentially have a black mark on their credit file or even lose their access to credit.
Unlike conventional identity theft, there is no direct victim to detect and report the crime. Business operators who see evidence of synthetic identity theft may either not recognize it or neglect to report it, thinking it is someone else’s problem. If the fraud plays out to its conclusion, however, everybody pays.
Newsletter
Get free MoneySense financial tips, news & advice in your inbox.
Michael is a financial writer and editor in Duncan, B.C. He’s a former managing editor of Canadian Business and editorial director of Canada Wide Media. He also writes for The Globe and Mail and BCBusiness.
